name: Sync OSS to GitHub

on:
  push:
    branches: [ main, master ]
    paths:
      - 'runtime/**'
      - 'dsl/**'
      - 'docs/**'
      - 'README.md'
      - 'Cargo.toml'
      - '.gitignore'
      - 'Dockerfile'
  workflow_dispatch:
    inputs:
      force_sync:
        description: 'Force sync even without changes'
        required: false
        default: 'false'

env:
  GITHUB_REPO: git@github.com:ThirdKeyAI/Symbiont.git

jobs:
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan for enterprise content
        run: |
          echo "🔍 Scanning for enterprise content..."
          
          # Check if enterprise folder exists in git
          if git ls-files | grep -q "enterprise/"; then
            echo "❌ ERROR: Enterprise files found in git index!"
            git ls-files | grep "enterprise/"
            exit 1
          fi
          
          # Check for enterprise references in code (excluding docs)
          if grep -r -i "enterprise" . \
             --exclude-dir=.git \
             --exclude-dir=enterprise \
             --exclude="*.md" \
             --exclude="Cargo.toml" \
             --exclude="*.yml" \
             --exclude="*.yaml" \
             --include="*.rs" \
             --include="*.py" \
             --include="*.js" \
             --include="*.ts" 2>/dev/null | grep -v "// Enterprise" | grep -v "# Enterprise"; then
            echo "⚠️  WARNING: Found enterprise references in code files"
            echo "Manual review required before sync"
            exit 1
          fi
          
          echo "✅ Security scan passed"

  sync-to-github:
    name: Sync to GitHub
    runs-on: ubuntu-latest
    needs: security-scan
    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
    environment: github-sync
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup SSH for GitHub
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.GITHUB_SSH_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan github.com >> ~/.ssh/known_hosts

      - name: Make sync script executable
        run: chmod +x scripts/sync_oss_to_github.sh

      - name: Run OSS sync
        env:
          CI: true
        run: |
          echo "🚀 Starting OSS sync to GitHub..."
          ./scripts/sync_oss_to_github.sh

      - name: Notify on success
        if: success()
        run: |
          echo "✅ Successfully synced OSS code to GitHub"
          echo "Repository: ${{ env.GITHUB_REPO }}"

      - name: Notify on failure
        if: failure()
        run: |
          echo "❌ OSS sync failed"
          echo "Check logs for security violations or sync errors"
          exit 1

  validate-github-repo:
    name: Validate GitHub Repository
    runs-on: ubuntu-latest
    needs: sync-to-github
    if: success()
    
    steps:
      - name: Setup SSH for GitHub
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.GITHUB_SSH_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan github.com >> ~/.ssh/known_hosts

      - name: Clone and validate GitHub repo
        run: |
          echo "🔍 Validating synced GitHub repository..."
          
          # Clone the GitHub repo to verify sync
          git clone ${{ env.GITHUB_REPO }} /tmp/github-repo
          cd /tmp/github-repo
          
          # Verify enterprise content is not present
          if [[ -d "enterprise" ]]; then
            echo "❌ ERROR: Enterprise folder found in GitHub repo!"
            exit 1
          fi
          
          # Verify core OSS components are present
          required_paths=("runtime" "dsl" "docs" "README.md" "Cargo.toml")
          for path in "${required_paths[@]}"; do
            if [[ ! -e "$path" ]]; then
              echo "❌ ERROR: Required OSS component '$path' missing from GitHub repo!"
              exit 1
            fi
          done
          
          echo "✅ GitHub repository validation passed"